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PRE-APPEAL BRIEF REQUEST FOR REVIEW 

Sir: 

In response to the Final Office Action mailed December 7, 2010, and in conjunction with 
the Notice of Appeal filed concurrently herewith, applicants respectfully request review of the 
final rejection of the claims of the above-referenced patent application in view of the following. 

Rejections To Be Reviewed 

Rejections under 35 U.S.C. §103(a) 

Claims 1-37 

Claims 1-37 stand rejected over U.S. Patent No. 7,374,077 to Shimura ("Shimura") in 
combination with U.S. Patent No. 7,080,098 to Smirniotopoulos et. al. ("Smirniotopoulos") and 
U.S. Publication No. 2004/0139043 to Lei et al. ("Lei"). 
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Claims 24-28 

Claims 24-28 stand rejected over Shimura in combination with U.S. Publication No. 
2003/0013951 to Stefanescu et al. ("Stefanescu"). 

Summary of Claimed Subject Matter 

Applicants' invention as claimed in claim 1 defines automatically anonymizing sensitive 
information by replacing each item of the sensitive identification data with an anonymization 
code and securely storing a relationship between the anonymization code and the sensitive 
patient identification data in a table in the database. Support for the claimed invention can be 
found in Figure 4 of the drawings and in paragraphs 148 to 156 of specification. Patient specific 
information retrieved from the clinical image archive is very sensitive and can only be referenced 
internally. It is not allowed to appear in teaching files and datasets, which may be published. 
Patient sensitive information can't be simply removed from the teaching files. Sometimes it is 
required to be able refer back to the actual patient. Therefore, patient sensitive information needs 
to be anonymized (see paragraph 142 of the specification). Applicants' invention as claimed in 
claim 1 provides a simplified access control scheme for the largest portion of the database, which 
saves computational resources. Additionally, securely storing the relationship between the 
anonymization code and the sensitive patient identification data in a table in the database 
centralizes the sensitive information in a small core table that can be easily secured (see 
applicants' Amendment as filed 9/23/10, last paragraph on page 1 lto first paragraph on page 12). 

Summary of Prosecution History 

During the interview of 8/25/10 applicants' proposed amendment to claim 1 was 
discussed in view of the 103 rejection in Office Action mailed 06/23/10. In the applicants' 
Amendment filed on 9/23/10 claim 1 was amended in light of this interview. This Amendment, 
in part, pointed out that Lei fails to disclose securely storing a relationship between the 
anonymization code and the sensitive patient identification data in a table in the database, as 
recited in amended claim 1 (see Amendment as filed on 9/23/10, page 14, first paragraph). The 
Examiner acknowledged that Shimura and Smirniotopoulos do not disclose that the automatic 
anonymizing of patient identification data includes replacing each item of the patient 
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identification data with an anonymization code and securely storing a relationship between the 
anonymization code and the patient identification data in a table in the database (page 5, Final 
Office Action mailed 12/07/10). The Examiner alleges that Lei discloses "replacing each item of 
the identification data with an anonymization code," and the Examiner refers to the replacing of 
the data from the attribute with the masking value of integer zero in paragraphs [0074] -[0075] of 
Lei as corresponding to this feature (page 17, Final Office Action mailed 12/07/10). In addition, 
the Examiner interpreted the applicants' claimed securely storing a relationship between the 
anonymization code and the sensitive patient identification data in a table in the database as 
corresponding to storing the modified data in masked result set described in paragraph [0074], 
line 10 in Lei (page 17, Final Office Action mailed 12/07/10). 
Argument 

The rejections of claims 1-37 rely on Lei as allegedly disclosing the recited in claim 1 
limitations of "storing a relationship between the anonymization code and the patient 
identification data in a table." Lei discloses that when a user inputs a query which references 
"NAME" and "SALARY", a database server obtains data for the requested names (non- sensitive 
information) and salaries (sensitive information) and stores this query result (paragraphs [0031], 
[0064], [0074]). In particular, Lei discloses that the query result can be masked by replacing the 
salary data with the masking value, integer zero, and the modified data is stored in a masked 
query result set (Table 1, paragraph [0074] of Lei). According to Lei, regardless of the amount of 
salary, the masking value is an integer zero as shown in Table 2 of Lei. In other words, Lei does 
not even disclose defining a relationship between the masking value (anonymization code) and 
the salary (sensitive information), let alone providing any motivation to securely storing such a 
relationship in a table in the database. 

In contrast, storing of a relationship between the anonymization code and the patient 
identification data in a table as recited in claim 1 of the present application would enable the 
retrieval of the patient identification data using the corresponding anonymization code in a 
secure way. However, Lei does not disclose or suggest storing such a relationship for possible 
retrieval of sensitive data later on. In fact, Lei discloses the result set 235 with both non-sensitive 
information (name) and sensitive information (salary), and the masked result set 233 with 
sensitive information (salary) anonymized stored in the database server 230. Because all the 
information are stored in the result set 235 and the masked result set 233 in the database server 
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230, there is no motivation to store an additional correspondence relationship between the 
masked value and the sensitive data. Therefore, Lei would not provide any motivation to 
securely store a correspondence relationship between the anonymization code and the sensitive 
data in a table. 

In another aspect, according to the subject matter of pending claim 1, the relationship 
between the anonymization code and the patient identification data is stored in a table in the 
database , which is the same database as the one which stores the plurality of medical images. In 
Lei, the entire data containing sensitive information (which is not anonymized) is stored in the 
main database 240 (table 2), which has to be fully protected against unauthorized access 
attempts. 

In contrast thereto, storing the relationship between the anonymization code and the 
patient identification data in a separate table in accordance with pending claim 1 allows securing 
only a small portion of the database instead of protecting the whole database as required in Lin. 
According to claimed invention, the main portion of the database which has the medical images 
stored thereon does not need to be protected because the patient identification information is 
anonymized in the main database. 

For the above reasons, Lei does not disclose or suggest "securely storing a relationship 
between the anonymization code and the patient identification data in a table in the database", as 
recited in claim 1. 

The references Shimura and Smirniotopoulos do not disclose that the automatic 
anonymizing of patient identification data includes replacing each item of the patient 
identification data with an anonymization code and securely storing a relationship between the 
anonymization code and the patient identification data in a table in the database, as 
acknowledged by the Examiner. 

Lei discloses attribute relevant access control policies. Shimura, in contrast, discloses 
similar image search system. Smirniotopoulos, in contrast, discloses medical multimedia 
database system. There is no motivation to combine these references as they are concerned with 
different problems. Furthermore, even if Shimura, Smirniotopoulos and Lei were combined, they 
would not make up for the deficiencies of Lei. Therefore, claim 1 is not obvious over Shimura, in 
view of Smirniotopoulos and Lei. 
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Given that claims 2-37contain at least "securely storing a relationship between the 
anonymization code and the sensitive patient identification data in a table in the database," 
claims 2-37 are not obvious over Shimura, in view of Smirniotopoulos and Lei. 

Stefanescu does not teach or suggest "securely storing a relationship between the 
anonymization code and the patient identification data in a table in the database," either. 

Given that claims 24-28 depend from claim 21, and add additional limitations, claims 24- 
48 are not obvious over Shimura in view of Smirniotopoulos, Lei and Stefanescu. 
Conclusion 

As set forth above, there are omissions by the Examiner of one or more essential 
elements needed to lay out a valid, prima facie case of obviousness. This has not been done in 
the current case, because even if the cited references were combined, such a combination would 
not meet all of the limitations of claims 1-37. When considering whether a claim is obvious, all 
of the limitations of the claim must be considered (see MPEP 2143.03). Because the suggested 
combination does not meet the limitations of the claims, no prima facie case of obviousness has 
been made, and the rejections of the claims under 35 U.S.C. § 103(a) should be withdrawn. 
Applicant respectfully requests the Pre- Appeal Conference direct the Examiner to enter an 
allowance for claims 1-4, 6, and 8-37. 
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